{"action":"closed","issue":{"url":"https://api.github.com/repos/AOSC-Dev/aosc-os-abbs/issues/785","repository_url":"https://api.github.com/repos/AOSC-Dev/aosc-os-abbs","labels_url":"https://api.github.com/repos/AOSC-Dev/aosc-os-abbs/issues/785/labels{/name}","comments_url":"https://api.github.com/repos/AOSC-Dev/aosc-os-abbs/issues/785/comments","events_url":"https://api.github.com/repos/AOSC-Dev/aosc-os-abbs/issues/785/events","html_url":"https://github.com/AOSC-Dev/aosc-os-abbs/issues/785","id":263605983,"number":785,"title":"palemoon: security update to 27.5.0","user":{"login":"l2dy","id":14329097,"avatar_url":"https://avatars3.githubusercontent.com/u/14329097?v=4","gravatar_id":"","url":"https://api.github.com/users/l2dy","html_url":"https://github.com/l2dy","followers_url":"https://api.github.com/users/l2dy/followers","following_url":"https://api.github.com/users/l2dy/following{/other_user}","gists_url":"https://api.github.com/users/l2dy/gists{/gist_id}","starred_url":"https://api.github.com/users/l2dy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/l2dy/subscriptions","organizations_url":"https://api.github.com/users/l2dy/orgs","repos_url":"https://api.github.com/users/l2dy/repos","events_url":"https://api.github.com/users/l2dy/events{/privacy}","received_events_url":"https://api.github.com/users/l2dy/received_events","type":"User","site_admin":false},"labels":[{"id":365941796,"url":"https://api.github.com/repos/AOSC-Dev/aosc-os-abbs/labels/security","name":"security","color":"b60205","default":false},{"id":256569692,"url":"https://api.github.com/repos/AOSC-Dev/aosc-os-abbs/labels/upgrade","name":"upgrade","color":"fbca04","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2017-10-07T01:05:44Z","updated_at":"2017-10-09T01:52:04Z","closed_at":"2017-10-09T01:52:04Z","author_association":"MEMBER","body":"Security fixes in 27.4.2:\r\n\r\n* Updated NSPR to 4.15.\r\n* Updated NSS to 3.31.1.\r\n* Fixed a DoS issue using overly long Username in URL scheme (CVE-2017-7783)\r\n* Fixed an issue where (cross domain) iframes could break scope (CVE-2017-7787)\r\n* Fixed an issue in WindowsDllDetourPatcher (CVE-2017-7804)\r\n* Fixed an issue with elliptic curve addition in mixed Jacobian-affine coordinates (CVE-2017-7781)\r\n* Fixed a UAF in nsImageLoadingContent (CVE-2017-7784)\r\n* Fixed a UAF in WebSockets (CVE-2017-7800)\r\n* Fixed a heap-UAF in RelocateARIAOwnedIfNeeded (CVE-2017-7809) DiD (accessibility is disabled)\r\n\r\nSecurity fixes in 27.4.0:\r\n\r\n* Removed preloading of HPKP hosts and enabled HPKP header enforcement.\r\n* Added support for TLS 1.3, the up-next secure connection protocol. 🎉\r\n* Fixed an issue with TLS 1.3 not supporting renegotiation by design.\r\n* Relaxed some restrictions for CSP to temporarily work around web compatibility issues with the CSP-3 deprecated child-src directive.\r\n* Updated NSS to 3.28.5.1-PM to address some security issues.\r\n* Updated the installer selfextractor module to address unsafe loading of libraries.\r\n* Changed the way certain resources are included to reduce effectiveness of some common fingerprinting techniques. (e.g. browserleaks.org)\r\n* Fixed a regression in the display of security information in the page info dialog for insecure content.\r\n* Fixed two potential issues with allocating memory for video. DiD\r\n* Fixed a potential issue with the network prediction algorithm. DiD\r\n* Restricted the use of Aspirational scripts in IDNs to prevent domain spoofing, in anticipation of the UAX#31 update making this official.\r\n* Prevented a Mac font specific issue that could be abused for domain spoofing (CVE-2017-7763)\r\n* Fixed several potentially exploitable crashes. (CVE-2017-7751) (CVE-2017-7757) and some that do not have a CVE designation."}}
{"actor":{"display_login":"MingcongBai"}}